In this workshop organised by Paradigma, focusing on ICT outsourcing governance and the management of regulatory, operational and contractual risks, Alessandro del Ninno addresses the integration of personal data protection, information security and operational resilience.

His presentation examines the role of the GDPR in managing relationships with ICT service providers, the responsibilities of organisations engaging in outsourcing arrangements, and the role of the Data Protection Officer in overseeing risks associated with personal data processing.

Particular emphasis is placed on the interaction between the GDPR, the Digital Operational Resilience Act (DORA) and the NIS 2 Directive, focusing on overlapping security obligations, ICT incident management and personal data breach notification requirements, including the different legal thresholds and reporting deadlines established by each regulatory framework. The analysis also explores the contribution of international information security standards, including ISO/IEC 27001, to developing an integrated compliance and risk management framework for ICT outsourcing.